Privacy
What we collect, why, for how long, and how to have it deleted. Updated 11 October 2026.
Who is responsible
Spark is run by Neðri Hóll Hugmyndahús ehf., reg. no. 470126-2480, Álfhólsvegur 97, 200 Kópavogur, Iceland. The company is the controller of the processing described here. Questions about it go to hallo@sparkwithai.app.
What we collect
Email, name and company name. When you use a course we record which videos you have watched, how far, and the answers you submit in exercises. We do not collect location, contacts or anything from your other systems. We also record when a course was first opened in your access or your company's.
Why
The email to sign you in, because we do not use passwords. Progress so you resume where you stopped. Answers so we can give you feedback. When a course was first opened, for purchases made on 11 October 2026, when the right to withdraw ended once the course was opened; only we see it, beside the order.
On what basis
Sign-in, progress, answers and feedback are needed to provide the service that was bought, by you or by the company that invited you (contract). Your company seeing its people's status rests on its legitimate interest in following up the training, and never extends to the text you write. Enquiries, protection against misuse and the site's security rest on our legitimate interests. Invoices and bookkeeping rest on a legal obligation under the Icelandic Bookkeeping Act. A public certificate of completion rests on your consent, which you can withdraw at any time. The access history, and the record of when a course was first opened, rest on our legitimate interest in being able to account for what happened and whether a right to withdraw has ended. Reminders that access is ending are part of the service that was bought.
Enquiries and invoices
If a company enquires about a course, we record its name and, where given, the name, role and email address of the person who got in touch, with a short note about the conversation, so we can reply and follow up. Someone who asks for a course on a sale page leaves a name and email address for the same purpose. Someone who writes to us through the contact form leaves a name, an email address, a company name if they wish, and the message itself, for the same purpose. We delete an enquiry 24 months after the last contact about it, or sooner if you ask. Invoices carry the payer's name, a description and the amount. An invoice we make in Payday for a company or school also carries the payer's ID number and email, which go to Payday with it. They are part of the company's bookkeeping records, which Icelandic bookkeeping law requires to be kept for seven years.
Payments
When you buy a course on a sale page you pay on the payment page of Teya, our card acquirer. Your name, email and the amount go to Teya with the order; card details go straight to Teya and we never see them. We keep your name, email, the course, the price and Teya's transaction number, so the payment can be confirmed and access closed if it is reversed. The invoice for the purchase is made in Payday, our accounting system, which receives your name, email, the course, the amount and the order's reference and emails you the invoice; it is kept for seven years under bookkeeping law. The order is deleted with the access, twelve months after it ends, or sooner if you ask. If you ask for the invoice to be made out to a company or school, its name and ID number go to Payday instead of yours. We also keep which version of the terms you accepted, and when, and that you asked for access straight away.
What the owner sees
Whoever manages your company’s access sees your name and email, whether you have accepted the invitation, how much of each part you have watched, and how many exercises are passed. They do not see the text you submitted. That is a decision we do not intend to change.
Access history
We record who invited whom and when, who was removed, when an invitation was accepted and when a part of a course was finished, along with changes to a company's seats, courses and access period, and when we viewed a course as you see it to help you. The record holds email addresses and times, never what you write, and only we see it. We use it to answer questions about the access later. It is deleted with the company's other data, except entries about the purchase itself (course, price and the buyer's email) and about invoices and payments, which are part of the bookkeeping records, and the record that data was deleted.
Email from us
We only send mail that has to do with your access, such as invitations, sign-in links, purchase confirmations and replies to what you send us. When 30 days of access remain, and again when 7 remain, we remind whoever manages your company's access, or you if you bought it yourself, that it is ending. Each reminder has a link to turn them off. If you turn them off, we keep that choice under a keyed hash of your email address, not the address itself, for as long as Spark runs, so they do not start again. That rests on our legitimate interest in respecting your choice.
What we pass on
Exercise answers go to the model that reviews them, a language model at Google. They are not used to train it. Your email, name and company name go to Resend, the mail service that sends invitations and sign-in links, and mail you send us goes the same way. Progress and answers are stored at Google Cloud within the European Union, the site runs at Vercel in Frankfurt and the videos are served from Bunny. The sign-in service and the language model are at Google and not bound to Europe, and Resend and Vercel are US companies, so some data may leave the European Economic Area. Such transfers rest on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
For how long
While a company or an individual has access, and for twelve months after, so the thread can be picked up if access is renewed. Then everything is deleted: answers, progress and each person's account, except certificates of completion you have made and what is described under Access history. Requests for access and invoices are kept to show what was agreed, invoices for seven years under bookkeeping law. Database backups are kept for fourteen weeks, so the data leaves those within that time too.
Security and logs
To protect against misuse we count attempts to sign in, buy and submit. The count is kept under a hash of the email address or IP address, and deleted automatically within two days. If an error happens on the site we record where, without sign-in links, and delete the record after 30 days. Vercel, which hosts the site, keeps service logs with IP addresses for a short time. If an email from us cannot be delivered, we record the address and the email's subject so the address on an order can be corrected, and delete it after 90 days.
Certificate of completion
If you finish a course and make a certificate, a public page is created with the name you gave, the course title, the date and the criteria you met, and you are emailed the link. Anyone with its address can open it. It is not listed with search engines. The certificate is kept after your access ends and your other data is deleted, until you withdraw it or ask for your data to be erased.
Your rights
You can ask for a copy of everything we hold about you, have what is wrong corrected, have it deleted, restrict its processing, object to processing based on legitimate interests, and receive data you gave us in a common, machine-readable format. Write to hallo@sparkwithai.app and we answer within thirty days. You can also complain to the Icelandic Data Protection Authority.
Cookies
One cookie keeps you signed in. If you choose a language or theme on your profile, two cookies keep that choice for a year. The public site sets no cookies; its theme choice is kept in your browser itself. No third-party cookies and no advertising tracking. An exercise answer you have written but not sent is kept in your browser until you send it, for at most 30 days, and does not reach us before then.